Capital Adequacy and Risk Management Report (Basel III Pillar 3 Disclosure)

Capital Adequacy and Risk Management Report (Basel III Pillar 3 Disclosure) as at 30 th June 2015 Issued October 2015

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 2 TABLE OF CONTENTS 1. Executive Summary... 3 2. Background... 4 3. Basel III Components... 5 3.1. Pillar 1 Minimum Capital Requirements... 6 3.2. Pillar 2 Supervisory Review Process... 7 3.3. Pillar 3 Market Discipline... 7 4. Risk and Capital Management... 8 4.1. Group Structure... 8 4.2. Risk and Capital Management Process... 8 5. Regulatory Capital Requirements... 10 5.1. Capital requirements for Credit Risk... 11 5.2. Capital requirements for Market Risk... 12 5.3. Capital requirements for Operational Risk... 13 5.4. Capital Structure... 14 5.5. Capital Adequacy Ratio (Pillar 1)... 17 6. Credit Risk... 18 6.1. Asset Classes... 18 6.2. Credit Exposure... 20 6.3. Credit Risk Mitigation... 26 6.4. Impaired Credit Facilities and Provisions for Impairment... 27 7. Market Risk... 29 7.1. Sensitivity Analysis of Interest Rate Risk in the Banking Book... 30 8. Operational Risk... 31 9. Other Risks (Pillar 2)... 33 10. Glossary... 34

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 3 1. Executive Summary The Capital Adequacy and Risk Management Report for Samba Financial Group ( Samba or the bank ) has been prepared in accordance with the public / market disclosure requirements and guidelines in respect of Pillar 3 of Basel III, as published by the Saudi Arabian Monetary Agency (SAMA) in December 2012 1. The purpose of this disclosure is to inform market participants of the key components, scope and effectiveness of Samba s risk management systems, risk measurement processes, risk profile and capital adequacy. This is accomplished by providing consistent and understandable disclosure of Samba s risk profile in a manner that enhances comparability with other institutions. Samba Financial Group (Samba) has been compliant with Basel requirements since 1 st January 2008; and since then Samba has been publishing these reports on a biannual basis as of June and December each year. Samba has adopted the Standardized Approach for Credit Risk, the Standardized Approach for Market Risk and the Standardized and Basic Indicator Approaches for determining the capital requirements for Operational Risk. These approaches have been discussed in detail in the following pages of this report. This Capital Adequacy and Risk Management Report provides details on Samba Financial Group s consolidated risk profile with business volumes by customer categories and risk asset classes, which form the basis for the calculation of our capital requirement. In accordance with the minimum capital requirement calculation methodology as prescribed under Basel III, Samba Financial Group s capital adequacy as at 30 th June 2015 and a comparison thereof with the figures as of 31 st December 2014 and 30 th June 2014 is as follows: Jun 2015 Dec 2014 Jun 2014 Total Capital Adequacy Ratio 19.8% 19.9% 18.7% Tier 1 Capital Adequacy Ratio 19.3% 19.2% 17.9% As of 30 th June 2015 total Risk Weighted Assets (RWA) amounted to SAR 206,584,205,000 which comprised of 86.6% Credit Risk; 7.1% Market Risk and 6.3% Operational Risk. 1 Per SAMA circular 19984 SAMA s Final Guidance Documents Concerning Implementation of Basel III Pillar 3 Component dated 29 th December 2012

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 4 2. Background Samba Financial Group is a Saudi Joint Stock company which has been in business in the Kingdom of Saudi Arabia since 1980 (more detailed information is available in the published Annual Financial Statements) and is listed on the Saudi Stock Exchange (Tadawul) under symbol 1090. As a commercial bank registered in the Kingdom of Saudi Arabia, Samba falls under the regulatory supervision of the Saudi Arabian Monetary Agency (SAMA). Samba provides commercial banking services such as loans, trade finance, consumer finance, credit cards and treasury products to all customer segments including retail (individuals), corporates and government and semi-government institutions. Samba also provides a broad range of Shariah compliant banking products approved by Samba s Shariah Board, an independent body of Shariah Scholars. Samba operates in overseas markets through branches in London, Dubai and Qatar. Samba also owns an 84.51% stake in Samba Bank Limited incorporated in Pakistan. Samba Bank Limited is a banking company engaged in commercial banking and related services and is listed on all the stock exchanges in Pakistan. Information disclosed in this report is at the highest consolidated level i.e. Samba Financial Group including all branches and subsidiaries as at 30 th June 2015. The information provided in this document is not required to be subjected to external audit; however, reconciliation with the financial accounts has been performed.

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 5 3. Basel III Components In December 2012, SAMA issued a circular 2 requiring banks operating in the Kingdom of Saudi Arabia to report their capital adequacy requirements according to the Basel III guidelines. Basel III is an international initiative (adopted by SAMA) with a view to ensure adequate capitalization of banks on a more robust risk-sensitive basis providing a framework for assessment of risk and calculation of regulatory capital requirement, i.e. the minimum capital that an institution must hold, given its risk profile. Basel III framework is intended to strengthen risk management practices and processes within financial institutions. SAMA s Basel II / III framework describes the following three pillars which are designed to be mutually re-enforcing and are meant to ensure an adequate capital base which corresponds to the overall risk profile of the bank: Pillar 1: Calculation of capital adequacy ratio based on charge for credit, market and operational risks stemming from business operations. Pillar 2: Supervisory review process which includes: o Internal Capital Adequacy Assessment Process (ICAAP) to assess incremental risk types not covered under Pillar 1; o Quantification of capital required for these identified risks; o The assurance that the bank has sufficient capital cushion (generated from internal / external sources) to cover these risks over and above the regulatory requirement under Pillar 1. Pillar 3: Market discipline through public disclosures that are designed to provide transparent information on capital structure, risk exposures, risk mitigation and the risk assessment process. These concepts are described in more detail in the following pages. This report represents Samba s market disclosure, under the Pillar 3 requirements, of its risk profile and capital adequacy as at the end of 30 th June 2015. 2 SAMA Circular 15689 dated December 2012, titled SAMA s Final Guidance Document Concerning Implementation of Capital Reforms under Basel III Framework

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 6 3.1. Pillar 1 Minimum Capital Requirements Basel II / III, as adopted and implemented by SAMA, cover the minimum regulatory capital requirement for banks for credit, market and operational risks stemming from its business operations. It also sets out the basis for consolidation of entities for capital adequacy reporting requirements, the definition and calculations of Risk Weighted Assets (RWA) and the various options given to banks to calculate these Risk Weighted Assets. The regulatory capital requirements are calculated according to the following formula (expressed as a percentage): Minimum Capital Requirements = Capital Base RWA where the Minimum Capital Requirements are to be 8% The table below describes the approaches available for calculating the RWA for each of the aforementioned risk types: Credit Risk Market Risk Operational Risk Standardized Approach Standardized Approach Basic Indicator Approach Foundation - Internal Ratings Based Approach (F-IRB) Advanced - Internal Ratings Based Approach (A-IRB) Internal Models Approach Standardized Approach Advanced Measurement Approach (AMA) Samba Financial Group has chosen the following approaches for each of the risk types. a) Credit Risk Samba Financial Group uses the Standardized Approach at the consolidated level for regulatory reporting purposes. This approach differs from the Basel I regulations in that it allows the use of external ratings, where available, from accredited ratings agencies for the determination of appropriate risk weights, and also includes a wider range of eligible financial collaterals. The RWAs are then calculated according to the following formula: RWA = Credit Equivalent Amount 3 for all asset classes x Regulatory Defined Risk Weight 4 b) Market Risk Samba Financial Group uses the Standardized Approach at the consolidated level for measurement of Market Risk capital requirement. Under this approach, the capital 3 Credit equivalent amount is determined as gross exposure less specific provisions less eligible credit risk mitigants. A credit conversion factor (CCF) or add-on percentage is then applied to off-balance sheet and derivative exposures respectively 4 The regulatory defined risk weight is determined by the counterparty asset class and the external rating of the counterparty, where applicable

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 7 charge for Market Risk is determined by converting positions in the trading book into risk weighted assets, as per the respective SAMA guidelines 5. c) Operational Risk Samba Financial Group, with the exception of Samba Bank Limited - Pakistan, uses the Standardized Approach for measurement of Operational Risk capital charge. Under this approach a range of beta coefficients (12% - 18%) are applied to the average gross income for the preceding three financial years for each of the eight predetermined business lines to calculate capital charge for Operational Risk. The Basic Indicator Approach is used in our subsidiary in Pakistan. A fixed alpha coefficient of 15% is applied to the average gross income for the preceding three years to arrive at the operational risk capital charge. 3.2. Pillar 2 Supervisory Review Process The Supervisory Review Process (SRP) under Pillar 2 requires banks to employ an Internal Capital Adequacy Assessment Process (ICAAP) aimed at: a) quantifying bank s own internal assessment of the level of capital that it deems appropriate to adequately cover all material risks that it is exposed to; and b) instituting a comprehensive process for business and capital planning to ensure that adequate capital is always available to cover its risk exposures. Banks are also required to identify sources for raising additional capital in case of need and to provide documented plans thereof. As part of this process banks are required to ascertain whether credit, market and operational risk capital charges calculated under Pillar 1 are adequate to cover bank s internal assessment of these risks or not. Furthermore, banks are expected to ascertain additional capital requirements (over and above the Pillar 1 requirements, if any) for credit, market and operational and the Pillar 2 risks that the banks are exposed to (examples of some risks identified in this respect are interest rate risk in the banking book, strategic risk, legal risk, concentration risk, etc.). The ICAAP has to be designed to ensure that banks have sufficient capital cushion to meet regulatory and internal capital requirements during periods of systemic / cyclical economic downturns or during times of financial distress - which involves employing stress testing and scenario analysis techniques. In compliance with the regulatory requirements, Samba has submitted its detailed ICAAP Plan for the period 2015-2017 to SAMA. 3.3. Pillar 3 Market Discipline Under Pillar 3, SAMA prescribes the qualitative and quantitative disclosures which are required to be made to external stakeholders of the bank 6. The disclosures are designed to enable stakeholders and market participants to assess an institution s risk appetite, risk exposures and risk profile. It encourages the move towards more advanced forms of risk management. A reporting calendar has also been provided by SAMA to indicate which disclosures are required at the defined intervals. Quarterly requirements are disclosed in the quarterly financial statements and semi-annual / annual disclosures are contained in this report. 5 As defined in SAMA circular BCS 355 of 29 th December 2004 6 Refer footnote on page 5

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 8 4. Risk and Capital Management In this chapter the consolidation principles for capital base within Samba are described, as well as the principles adopted for the management and control of risk and capital. 4.1. Group Structure Samba Financial Group follows the Accounting Standards for Financial Institutions promulgated by the Saudi Arabian Monetary Agency (SAMA) and International Financial Reporting Standards (IFRS). Samba also prepares its consolidated financial statements to comply with the Banking Control Law and the Regulations for Companies in the Kingdom of Saudi Arabia. The consolidated financial statements as at 30 th June 2015 include the financial statements of the Bank and its following subsidiaries. Samba Bank Ltd: An 84.51% owned subsidiary incorporated as a banking company in Pakistan and engaged in commercial banking and related services. This entity is listed on all stock exchanges in Pakistan. Samba Real Estate Company: A wholly owned subsidiary incorporated in Saudi Arabia under commercial registration number 1010234757 issued in Riyadh dated 9 th Jumada II, 1428H (24 th June 2007). The company has been formed as limited liability company with the approval of SAMA and is engaged in managing real estate projects on behalf of Samba Real Estate Fund and Samba Financial Group. Samba Capital and Investment Management Company: A wholly owned subsidiary incorporated in Saudi Arabia under commercial registration number 1010237159. It was formed in accordance with the Securities Business Regulations issued by the Capital Market Authority (CMA), requiring banks in Saudi Arabia to transfer their dealing, arranging, managing, advising and custody businesses into a separate legal entity licensed with CMA. This is referred to as Samba Capital. Co-Invest Offshore Capital Limited: A wholly owned company incorporated under the laws of Cayman Islands for the purpose of managing certain overseas investments. The aggregation consolidation method is applied to subsidiaries reporting in other regulatory jurisdictions. To this end Samba Bank Limited calculates its Risk Weighted Assets according to the regulations defined by the State Bank of Pakistan. 4.2. Risk and Capital Management Process Samba is exposed to a broad range of risks in the normal course of its business. The bank s risk and capital assessment policies are designed to identify and quantify these risks, set appropriate limits in line with defined risk appetite, ensuring control and monitoring adherence to the limits. The principal risks associated with Samba s business are credit risk, including cross-border and concentration risks, market risk, liquidity risk, operational risk and reputation / franchise risk.

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 9 The Executive Committee of the Samba Board formulates high level strategies and policies, approves specific transactions or programs that may pose material risks to the institution and monitors the bank s risk profile on an ongoing basis. This Committee, which has been appointed and empowered by the Samba Board of Directors, comprises five Board Members. On 23 rd April 2013, the Board of Directors approved the formation of a Board Risk Committee as required by SAMA 7. This Committee is chaired by a non-executive director and is comprised of a further two directors. Its main function is to assist the Board in overseeing the credit and other risk management processes, including the overall internal control framework and IT/IS related risks. The process of risk management is supported by a set of independent control functions reporting to the Chief Risk Officer. Individual credit transactions are approved jointly by selected Credit Officers including both Business and independent Risk Management representatives. The Credit Risk Control department reviews approval levels and documentation prior to allowing the availment of facilities. Market Risk Management department reviews limits and provides independent reports about the bank s market risk exposures and liquidity positions, including measurement against stressed events. The Group Risk and Capital Strategy department manages the process of risk appetite definition, portfolio targets, risk measurement and overall limit setting. The risk governance structure includes the following management committees: Asset Liabilities Committee (ALCO), chaired by the General Manager, is responsible for the monitoring and management of liquidity, the balance sheet and market risk resulting from the accrual portfolio. Market Risk Policy Committee (MRPC) is the management body within Samba for market and liquidity risk issues, including establishing and updating policies and guidelines, reviewing and approving market risk limits and exceptions. Credit Risk Policy Committee (CRPC) has Samba-wide responsibility for maintaining sound and effective credit risk management architecture and process. Capital Management Committee (CMC) examines components of the capital plan and proposes the internal capital adequacy targets for approval by the Executive Committee. Samba Audit Risk Review (ARR) reports functionally to the Audit Committee of the Samba Board and has responsibility for: Providing independent evaluation of Samba s risk portfolio and processes. Assessing the adequacy of Bank s policies, practices and procedures for risk management. Documenting its findings in action-oriented reports for the relevant Board / Management Committees and Senior Management. 7 Rules on Credit Risk Management issued by SAMA in January 2013

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 10 5. Regulatory Capital Requirements This chapter describes Samba s capital requirements, calculated on the basis of regulatory guidelines. The risk types under Pillar 1 are in accordance with Basel II / III guidelines issued by SAMA 8 and contain credit, market and operational risks. As at 30 th June 2015 Samba s overall regulatory capital requirements under Pillar 1 can be broken down as follows. SAR 000s Risk Type Capital Requirement % of Total Requirement Credit Risk 14,306,587 86.6 % Market Risk 1,172,596 7.1 % Operational Risk 1,047,554 6.3 % Total 16,526,737 100.0% 8 Refer footnote on page 5

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 11 5.1. Capital requirements for Credit Risk Samba calculates the capital requirements for credit risk according to the Standardized Approach. Under this approach, exposures are assigned to portfolio segments based on the type of counterparty and/or the nature of the underlying exposure. The major portfolio segments as defined by the Basel guidelines adopted by SAMA are sovereigns, banks, corporates, retail, securitized assets and VIP/HNI (high networth individuals). Each segment has a defined risk weight ranging from 0% to 150% depending on tenor, type of exposure, asset class, whether the counterparty has an external rating and whether the exposure is past due. The following table describes the amount of exposures subject to credit risk and the related capital requirements, by portfolio. Portfolio Amount of Exposures RWA SAR 000s Capital Requirements Sovereigns and Central Banks 56,689,207 30,326 2,426 Public Sector Entities 3,209,679 1,604,840 128,387 Banks and Securities Firms 21,242,696 8,479,892 678,391 Corporates 102,502,584 97,751,002 7,820,080 Retail Non-Mortgages 15,031,361 11,273,521 901,882 Mortgages - Residential and Commercial 5,493,080 5,493,080 439,446 Past Due Loans * 1,748,476 1,115,528 89,242 Equities 19,285 19,285 1,543 VIP/HNI 10,217,548 10,200,691 816,055 Others ** 16,768,019 3,254,519 260,362 Total - On Balance-Sheet *** 232,921,936 139,222,684 11,137,815 Off Balance-Sheet 56,818,334 30,160,967 2,412,877 Derivatives (including CVA) 6,224,237 9,448,685 755,895 Total 295,964,507 178,832,335 14,306,587 * Includes impaired loans ** Primarily fixed assets, cash, items in the course of collection, investments and sundry assets *** Exposures are stated in this report at gross values and are therefore not directly comparable with the bank s consolidated financial statements, which are disclosed on a net basis. Items included in the gross values comprise provisions, collaterals, UID (Unearned interest, commission and discount) and interest in suspense A detailed definition of each portfolio is contained in chapter 6 of this report.

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 12 5.2. Capital requirements for Market Risk Samba uses the Standardized Approach to calculate the regulatory capital requirements relating to general market and specific market risks. The resultant measure of market risk is multiplied by 12.5, the reciprocal of the theoretical 8% minimum capital ratio, to give market risk-weighted exposure on a basis consistent with credit risk-weighted exposure. The principal market risks to which Samba is exposed are foreign exchange risk, interest rate risk and equity price risk associated with its trading, investment and asset and liability management activities. This figure does not include Interest Rate Risk in the Banking Book, as this is considered as part of the Pillar 2 risks (refer chapter 9 of this document). Brief descriptions of the risk items covered by market risk are given below: a. Interest rate risk is the impact on banks earnings and market value of equity due to changes in interest rates; the risk is two-fold: Specific Risk: Risk of loss caused by an adverse price movement of a debt instrument or security due principally to factors related to the issuer. General Market Risk: Risk of loss arising from adverse changes in market conditions. b. Equity position risk is the risk that the bank s investments will depreciate due to the dynamics of the equity markets. c. Foreign exchange risk is the risk arising from a change in exchange-rates impacting the bank s net asset / liability positions. d. Commodity risk refers to the uncertainties of future market values and of the size of the future income, caused by fluctuation in the prices of commodities. The capital requirements for Market Risk, calculated on assets and positions held in the trading book, are presented in the table below. SAR 000s Market Risk Type RWA Capital Requirements Interest Rate risk * 4,567,425 365,394 Equity Position risk 8,824,263 705,941 Foreign Exchange risk 1,211,625 96,930 Commodity risk 54,138 4,331 Total 14,657,450 1,172,596 * of which Capital Requirement related to Securitized Assets is SAR 215,138

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 13 5.3. Capital requirements for Operational Risk Samba uses the Standardized Approach, while Samba Bank Limited - Pakistan uses the Basic Indicator Approach, for calculation of regulatory capital requirements with respect to Operational Risk. The Standardized Approach applies a range of beta coefficients (12% - 18%) to the average gross income for the preceding three financial years for each of eight predetermined business lines, while the Basic Indicator Approach applies a standard alpha coefficient of 15% to the overall average gross income (where positive) for the preceding three financial years. The capital requirements are detailed in the table below. Business line Beta / Alpha Coefficient SAR 000s Total Capital requirement Samba Financial Group (Standardized Approach) Agency Services Asset Management Commercial Banking Corporate Finance Payment and Settlement Retail Banking Retail Brokerage Trading and Sales 15% 12% 15% 18% 18% 12% 12% 18% 1,038,258 Samba Bank Limited - Pakistan (Basic Indicator Approach) Overall Gross Income 15% 9,296 Samba Financial Group (Consolidated) 1,047,554

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 14 5.4. Capital Structure Samba maintains an adequate capital base to cover risks inherent in its business operations. The adequacy of capital is actively managed and monitored using, among other measures, the rules and ratios established under Basel II / III regulations, as adopted by SAMA 9. The primary objective of Samba s capital management is to ensure that the bank maintains a sufficient level of capital at all times to meet / exceed all regulatory and internal requirements and achieve a strong credit rating while optimizing shareholder s value. The total eligible capital (Tiers 1 and 2) calculated in accordance with SAMA guidelines is a follows. SAR 000s 9 Refer footnote on page 5

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 15

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 16 The above table is consistent with the Capital Structure Disclosure - June 2015 report previously disclosed on our website.

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 17 5.5. Capital Adequacy Ratio (Pillar 1) Entity Total capital ratio % Tier 1 capital ratio % Samba Financial Group (consolidated) 19.8% 19.3% Samba Bank Limited, Pakistan 32.7% 31.9% Samba has consistently maintained its capital adequacy ratio well above the regulatory minimum of 8%.

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 18 6. Credit Risk In this section, Credit Risk components are disclosed according to the following dimensions: a. Basel asset classes used in the calculation of RWA; b. Geography, industry, maturity and risk weight buckets as defined by Basel; c. The effects of credit risk mitigation; d. Status of the loan book (performing / impaired) and corresponding loan loss reserves. 6.1. Asset Classes Samba has a diversified credit portfolio, which is divided into the following asset classes as defined by SAMA 10 : Sovereigns and Central Banks Exposures to sovereigns and central banks carry a risk weight ranging between zero and 100 percent, depending on the external rating assigned by the relevant ECAIs. The average risk weight for this portfolio is 0.1%. Public Sector Enterprises SAMA has prescribed that exposures falling into this portfolio are to be treated according to Option 2 of the Basel II Accord, i.e. the risk weight is determined on the basis of external rating of the PSE assigned by a recognized ECAI. The average risk weight for this portfolio is 50.0%. Banks and Securities Firms SAMA has prescribed that exposures falling into this portfolio are to be treated according to Option 2 of the Basel II Accord, i.e. the risk weight is determined on the basis of external rating of the bank or securities firm assigned by a recognized ECAI. A preferential risk weight is assigned to short term exposures, defined as those exposures with a tenor of less than three months. The average risk weight for this portfolio is 39.9%. Corporates This portfolio is assigned a risk weight based on the external rating of the counterparty, wherever available, with whom the exposure is held. Due to the fact that the majority of corporates in Saudi Arabia are not rated by ECAIs, a regulatory risk weight of 100% is applied to a large portion of this portfolio. The average risk weight for this portfolio is 95.4%. 10 Per paragraph 4.1 of Basel II - SAMA s Detailed Guidance Document Consultative Draft No.2 issued 6 th June 2006

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 19 Retail Non-Mortgages This portfolio consists of loans to individuals, leases, credit cards and other consumer loans. SAMA requires that exposures not meeting certain granularity criteria be assigned a 100% risk weight, whereas the balance of the exposure under this asset class is assigned a flat 75% risk weight. Mortgages - Residential and Commercial SAMA has prescribed a risk weight of 100% for this asset class. Past Due Loans Past due loans have been classified according to the regulatory definition, i.e. 90 days and above. These net exposures carry risk weights of either 100% or 150% depending on the level of specific provisions held thereagainst. The average risk weight for this portfolio is 63.8%. Equities Equities include investments in private equity and shares quoted on the public stock exchanges and held in the banking book. The average risk weight for this portfolio is 100.0%. VIP/HNI This portfolio has been defined to include exposures to high net worth individuals that fall outside the scope of Retail exposures. These would therefore include exposures to individuals in excess of SAR 5 million and are not managed on a pooled basis. For regulatory purposes these exposures are assigned a 100% risk weight. The average risk weight for this portfolio is 99.8%. Others The standard risk weight for all other assets is prescribed at 100%. These typically include fixed assets, prepayments and sundry debtors. Cash and cash equivalents are assigned a risk weight of 0%. The average risk weight for this portfolio is 19.4%.

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 20 6.2. Credit Exposure 6.2.1 Gross Credit Exposure The gross credit exposure as presented in the table below is reflected before applying any credit risk mitigation, such as financial collaterals and guarantees. Portfolio On Balance- Sheet Credit Risk Exposure Off Balance- Sheet Derivatives * Gross Credit Risk Exposure SAR 000s Average Credit Risk Exposure ** Sovereigns and Central Banks 56,689,207 3,035-56,692,242 55,627,022 Public Sector Entities 3,209,679 80-3,209,759 1,604,880 Banks and Securities Firms 21,242,696 5,454,375 3,091,812 29,788,883 29,575,996 Corporates 102,502,584 49,474,940 3,128,908 155,106,432 154,752,501 Retail Non-Mortgages 15,031,361 - - 15,031,361 14,809,132 Mortgages - Residential and Commercial 5,493,080 - - 5,493,080 5,576,857 Past Due Loans *** 1,748,476 - - 1,748,476 1,786,716 Equities 19,285 - - 19,285 116,870 VIP/HNI 10,217,548 1,885,904 3,517 12,106,969 11,152,748 Others **** 16,768,019 - - 16,768,019 16,975,767 Total 232,921,936 56,818,334 6,224,237 295,964,507 291,978,488 * Samba holds SAR 258 Million as collateral in its favor against these positions from counterparties under margining agreements ** Averaged over the period *** Includes impaired loans **** Primarily fixed assets, cash, items in the course of collection, investments and sundry assets The gross credit exposure for derivative instruments includes the replacement cost (current exposure) representing the cost of replacing the contracts at current market rates should the counterparty default prior to settlement date. It also includes the add-on for potential future exposure which is used to determine the RWA amount for these exposures.

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 21 6.2.2 Geographic breakdown of on-balance sheet credit risk exposures Portfolios Saudi Arabia Other GCC Europe Geographic Area North America South East Asia Other Countries SAR 000s Sovereigns and Central Banks 47,442,024 581,639 1,040,215 7,089,287 12,654 523,388 56,689,207 Public Sector Entities 3,209,679 - - - - - 3,209,679 Banks and Securities Firms 7,889,473 3,840,006 6,120,406 2,657,981 10,783 724,046 21,242,696 Corporates 89,666,539 8,340,105 1,485,252 2,157,951 54,381 798,356 102,502,584 Retail Non-Mortgages 14,493,065 533,901 - - - 4,395 15,031,361 Mortgages - Residential and Commercial 5,481,217 - - - - 11,863 5,493,080 Past Due Loans * 1,739,528 7,382 - - - 1,566 1,748,476 Equities 18,917 - - - - 368 19,285 VIP/HNI 10,217,548 - - - - - 10,217,548 Others ** 16,373,147 130,816 5,602 - - 258,454 16,768,019 Total 196,531,138 13,433,850 8,651,476 11,905,218 77,818 2,322,436 232,921,936 * Includes impaired loans ** Primarily fixed assets, cash, items in the course of collection, investments and sundry assets Total Approximately 84% of Samba s portfolio is domiciled in Saudi Arabia, the host jurisdiction, thereby shielding it largely from the global financial markets. Through its expansion via acquisition in Pakistan, coupled with the opening of branches in Dubai and Qatar, Samba has sought to geographically diversify its credit risk exposure.

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 22 6.2.3 Industry sector breakdown of on-balance sheet credit risk exposures SAR 000s Portfolios Govt and Quasi Govt Banks and Other Financial Institutions Agriculture and Fishing Mining and Quarrying Electricity, Water, Gas and Health Services Industry Sector Building and Construction Commerce Manufacturing Transportation and Communication Services Consumer Loans and Credit Cards Sovereigns and Central Banks 56,689,207 - - - - - - - - - - - 56,689,207 Public Sector Entities - - - - 1,166,741 - - - 2,042,938 - - - 3,209,679 Banks and Securities Firms - 21,242,696 - - - - - - - - - - 21,242,696 Corporates - - 5,207,576 20,340,645 4,202,797 8,211,837 11,877,872 22,028,635 14,741,670 12,880,016-3,011,535 102,502,584 Retail Non-Mortgages - - - - - - - - - - 15,031,361-15,031,361 Mortgages - Residential and Commercial - - - - - - - - - - 5,493,080-5,493,080 Past Due Loans * - - 353 38,433-21,658 780,933 66,079 10,045 647,657 123,442 59,876 1,748,476 Equities - - - - - - - - - - - 19,285 19,285 VIP/HNI - - 48,802 - - - - 8,995,161-780,488-393,097 10,217,548 Others ** - - - - - - - - - - - 16,768,019 16,768,019 Total 56,689,207 21,242,696 5,256,731 20,379,078 5,369,538 8,233,495 12,658,805 31,089,875 16,794,653 14,308,161 20,647,884 20,251,812 232,921,936 Others Total * Includes impaired loans ** Primarily fixed assets, cash, items in the course of collection, investments and sundry assets

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 23 6.2.4 Maturity breakdown of on-balance sheet credit risk exposures The maturity profiles of credit exposures have been determined on the basis of the remaining period at the reporting date to the contractual maturity date. SAR 000s Portfolios Less than 8 days Maturity Breakdown 8-30 days 30-90 days 90-180 days 180-360 days 1-3 years 3-5 years Over 5 years Sovereigns and Central Banks 674 377,333 750,008 4,990,072 24,920,491 7,837,210 2,789,508 5,112,263 * 9,911,649 56,689,207 Public Sector Entities - - - - - 120,417 2,978 3,086,285-3,209,679 Banks and Securities Firms 905,365 29,742 121,099 678,522 1,917,984 2,492,552 1,564,566 13,532,866-21,242,696 Corporates 1,572,870 9,784,315 12,210,954 11,707,738 9,715,834 11,545,125 26,838,432 19,127,317-102,502,584 Retail Non-Mortgages - 1,629,393 735,795 1,083,399 2,074,648 6,665,418 2,748,318 94,390-15,031,361 Mortgages - Residential and Commercial - 47,348 94,612 141,809 282,273 1,099,406 1,008,810 2,818,822-5,493,080 Past Due Loans ** - - - - - - - - 1,748,476 1,748,476 Equities - - - - - - - - 19,285 19,285 VIP/HNI 12,600 791,953 818,309 1,071,825 6,262,348 25,000 69,000 1,166,512-10,217,548 Others *** - - - - - - - - 16,768,019 16,768,019 Total 2,491,509 12,660,084 14,730,778 19,673,365 45,173,578 29,785,128 35,021,612 44,938,455 28,447,428 232,921,936 No Fixed Maturity Total * Balances with Central Banks ** Includes impaired loans *** Primarily fixed assets, cash, items in the course of collection, investments and sundry assets

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 24 6.2.5. Allocation of on-balance sheet exposures to risk weight buckets An analysis of the portfolio by the regulatory risk weight buckets is presented in the table below: SAR 000s Portfolio Risk Buckets 0% 20% 50% 75% 100% 150% Total Sovereigns and Central Banks 56,648,758 12,654 - - 27,795-56,689,207 Public Sector Entities - - 3,209,679 - - - 3,209,679 Banks and Securities Firms - 6,990,655 14,186,448-65,593-21,242,696 Corporates - 2,225,490 5,745,751-94,531,343-102,502,584 Retail Non-Mortgages - - - 15,031,361 - - 15,031,361 Mortgages - Residential and Commercial - - - - 5,493,080-5,493,080 Past Due Loans * - - - - 1,153,115 595,361 1,748,476 Equities - - - - 19,285-19,285 VIP/HNI - - - - 10,217,548-10,217,548 Others ** 13,513,500 - - - 3,254,519-16,768,019 Total 70,162,258 9,228,800 23,141,878 15,031,361 114,762,278 595,361 232,921,936 * Includes impaired loans ** Primarily fixed assets, cash, items in the course of collection, investments and sundry assets Exposures attracting 0% risk weight are primarily to Sovereigns and Central Banks which historically demonstrate an extremely low risk. In addition, cash and the positive fair value of derivatives contracts (as they are treated separately according to the current exposure method under Basel regulations - refer paragraph 6.2.6) also fall in the 0% risk weight category. 20% risk weight is applied to highly rated Banks and Corporates, whereas 50% is applied to lesser rated entities in the aforementioned asset classes. Furthermore, unrated Public Sector Enterprises, as defined by SAMA, also attract 50% risk weight. Retail exposures attract a 75% risk weight, while the remaining asset classes attract 100% risk weight. Past due exposures whose level of loan loss provisioning is only up to 20% of the outstanding exposure are assigned a 150% risk weight.

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 25 6.2.6. Exposures related to Counterparty Credit Risk (CCR) Counterparty credit risk is the likelihood that bank s counterparty in a foreign exchange, interest, commodity, equity or credit derivative contract will default prior to maturity of the contract and the bank at that time has a claim on the counterparty. Counterparty credit risk is subject to credit limits like other credit exposures and is treated accordingly. Counterparty credit risk mainly arises in the trading book. General disclosures for exposures related to Counterparty Credit Risk are presented in the table below. SAR 000s Particulars Amount Gross Positive Fair Value of Contracts 2,873,695 Collateral held: -Cash (Under Margining Agreements) 258,000 Exposure Amount (under the applicable method) -Current Exposure Method (CEM) 6,224,237 Notional Value of Credit Derivative Hedges 218,114,016 Current Credit Exposure (by type of credit exposure): -Interest Rate Contracts 2,684,032 -FX Contracts 2,957,940 -Equity Contracts 386,285 -Commodity/ Other Contracts 195,980 Samba uses the current exposure method to assess the counterparty credit risk in accordance with the credit risk framework and it is measured as the positive mark-tomarket value plus the notional principal amount multiplied by the regulatory defined add-on factor. The size of the add-on depends on the contract s remaining lifetime and the underlying asset. To reduce the exposure towards single counterparties, risk mitigation techniques are widely used. In addition Samba also mitigates the exposures towards large banks and financial institutional counterparties by an increasing use of financial collateral agreements called margining agreements, whereby collateral is topped-up on a regular basis - collateral is placed or received to cover the current exposure beyond certain agreed threshold on either side.

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 26 6.3. Credit Risk Mitigation The gross credit exposures disclosed in the earlier sections have been stated prior to taking credit risk mitigation effects into account. In terms of the regulatory guidelines, not all forms of collateral currently used by Samba are recognized for the purposes of calculation of credit risk capital requirement. These ineligible collaterals include interalia, corporate and personal guarantees and equity shares. The bank uses the comprehensive method for the treatment of financial collaterals which requires a standard supervisory haircut to be applied to the acceptable collateral to account for currency and maturity mismatches between the underlying exposure and the collateral applied. The asset classes where Samba holds eligible Basel collateral are disclosed by portfolio in the table below: SAR 000s Portfolio Gross Exposure Covered by eligible financial collateral Corporates 155,106,432 1,386,697 VIP/HNI 12,106,969 40,593 Total 167,213,401 1,427,290 Eligible financial collaterals under the Standardized Approach include 11 : a. Cash (as well as certificates of deposit or comparable instruments issued by the lending bank); b. Bank Guarantees; c. Gold; and d. Debt securities. 11 Per paragraph 15.4 of Additional Guidance Notes GN-2 contained in the Basel II Package of Bank Returns and Guidance Notes Regarding the Standardized Approach issued on 29 th March 2007 by SAMA

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 27 6.4. Impaired Credit Facilities and Provisions for Impairment A specific provision (for accounting treatment of impairment in assets) is made for past due facilities in respect of individually assessed loans or claims. Samba calculates the specific provision according to the guidelines contained in IAS 39 12. These are calculated at counterparty level and the bank considers all the facilities for a counterparty to be defaulted if any one of the facilities of the counterparty is past due. The specific provisions are based on an assessment of the impairment in realizable value of the asset first at the facility level and then aggregated at the counterparty level. 6.4.1 Impaired Loans, Past Due Loans and Allowances (by Industry Sector) Industry Sector Impaired Loans Past Due (>90 days), not Impaired Defaulted * Ageing of Past Due Loans (days) Less than 90 90-180 180-360 Over 360 Government and quasi government - - - - - - - - Banks and financial institutions - - - 44 - - - 28,082 Agriculture and fishing 353-353 26,636 - - 353 14,329 Manufacturing 38,433-38,433 35,356 - - 38,433 225,637 Mining and quarrying - - - 33,196 - - - 10,262 Electricity, water, gas and health services 21,658-21,658 417 - - 21,658 63,869 Building and construction 780,933-780,933 92,140 147,884 45,378 587,671 870,721 Commerce 66,079-66,079 54,759 - - 66,079 181,592 Transportation and communication 1,402 8,643 10,045 454 8,643-1,402 52,685 Services 647,657-647,657 2,174 - - 647,657 683,284 Consumer loans and credit cards 29,162 94,280 123,442 558,774 - - 123,442 250,848 Others 59,876-59,876 45,808 26,607 258 33,011 287,304 Total 1,645,553 102,923 1,748,476 849,758 183,134 45,636 1,519,706 2,668,613 * In accordance with the Basel definition of default, all exposures which are 90 days or more past due are tagged as defaulted. These defaulted exposures include the impaired loans SAR 000s Specific & Portfolio Allowances 12 IAS 39: Financial Instruments: Recognition and Measurement as issued by the International Accounting Standards Board

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 28 6.4.2 Impaired Loans and Allowances (by geographic area) SAR 000s Geographic area Impaired loans Specific and portfolio allowances Saudi Arabia 1,562,794 2,573,780 Other GCC & Middle East 8,002 21,642 Europe - - Other Countries 74,757 73,191 Total 1,645,553 2,668,613 6.4.3 Reconciliation of changes in the Allowances for Loan Impairment Particulars Specific and portfolio allowances SAR 000s Balance, beginning of the year 2,667,640 Charge-offs / Recoveries taken against the allowances during the period (34,155) Amounts set aside (or reversed) during the period 35,082 FX Translation difference (overseas Subsidiary) 46 Balance, end of the period 2,668,613

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 29 7. Market Risk Market Risk is the risk that Samba s earnings or capital, or its ability to support its business strategy, will be impacted by changes in market rates or prices related to interest rates, equity prices, credit spreads, foreign exchange rates and commodity prices. Samba has established risk management policies and limits within which exposure to market risk is monitored, measured and controlled by the Market Risk Management (MRM) division with strategic oversight exercised by ALCO. MRM is responsible for developing and implementing market risk policy and risk measuring / monitoring methodologies and for reviewing all new trading and investment products and product limits prior to ALCO approval. MRM has the primary responsibility to measure, report, monitor and control Market Risk in Samba. MRM is independent of Treasury business and reports into Risk Management. Samba classifies market risk into the following categories: FX Risk Risk Item Interest Rate Risk (Trading Book) Equity Risk Options Risk Commodity Risk Interest Rate Risk (Banking Book) Description Foreign Exchange Risk is the risk arising from a change in exchange rates on bank s net asset / liability / off balance-sheet positions. Interest Rate Risk is the risk of holding or taking positions in debt securities and other interest rate related / fixed income instruments in the trading book and is two-fold: Specific Risk: Risk of loss caused by an adverse price movement of a debt instrument or security principally due to factors related to the issuer. General Market Risk: Risk of loss arising from adverse changes in market conditions. Equity Risk is the risk that the equity investments held in the trading book will depreciate due to equity market dynamics. Is the implicit risk from an open option position arising from the option s sensitivity to a number of factors (Delta, Gamma and Vega risks). Is the uncertainty of future market values and of the size of the future income arising from commodity trading positions due to price fluctuation. Interest Rate Risk (in the Banking Book) is the current or prospective risk to both the earnings and capital arising from the impact of adverse movements in interest rates on mismatches in asset-liability structure.

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 30 7.1. Sensitivity Analysis of Interest Rate Risk in the Banking Book Sensitivity analysis of the Interest Rate Risk in the Banking Book (IRRBB) is presented in the table below. 200bp Interest Rate Shocks for currencies with more than 5% of Assets or Liabilities SAR 000s Rate Shocks Change in earnings Upward rate shocks: SAR (532,468) USD (728,437) EUR (138,045) Downward rate shocks: SAR 280,958 USD 567,371 EUR 46,804

Capital Adequacy and Risk Management Report as at 30 th June 2015 Page 31 8. Operational Risk Operational Risk is defined as the risk of loss resulting from inadequate or failed internal processes, people, systems and/or external events. It is evident that operational risk is inherent in all activities within the organisation, in outsourced activities and in all interactions with external parties. Management of Operational Risk requires robust internal controls coupled with quality supervision and management. In Samba, Operational Risk Management (ORM) is an integrated function with all the underlying Operational Risk elements like Anti-Fraud, Quality Assurance, Business Continuity and Policy & Procedure forming a part of the operational risk management chain. Operational risk is embedded in each business area and risk mitigation techniques are applied to each activity. All products / services are covered in Self- Assessment Grids which are independently tested periodically and monitored on a global basis. Any exceptions and quality deficiencies are documented and monitored for resolution on Samba-wide basis. These are complemented by comprehensive reviews by Internal Audit / Quality Assurance unit. The analysis of operational risk related events, potential risk indicators and other early-warning signals are in focus when developing the processes. The exceptions / issues are highlighted and resolved at the senior level in Group Risk & Compliance Committee (GRCC). The global Key Risk Indicators (KRIs) for the top ten components of Operational Risk are monitored and the exceptions along with the heat-map are escalated to the Senior Management for resolution. Mitigating techniques include a robust Information Security framework, strong Anti- Fraud / Compliance regime, comprehensive Physical / Access security and Certified Business Continuity plans together with crisis management preparedness and a broad insurance coverage for handling major incidents. Each business area in Samba is primarily responsible for managing its own operational risk. Operational Risk Management Division develops and maintains a framework for identifying, assessing, monitoring and controlling operational risk and supports the line organisation in implementing the framework. Automation for operational risk management includes Loss Database, Risk & Control Self- Assessment process, KRIs and Corrective Action tracking. The techniques and processes for managing operational risk are structured around the risk sources as described in the definition of operational risk. This approach improves the comparability of risk profiles throughout the organisation including Samba s branches and subsidiaries. It also supports the focus on limiting and mitigating measures in relation to the sources, rather than the symptoms. As described in chapter 5.3 the capital requirement for operational risk is calculated according to the Standardised approach, in which all of the institution s activities are divided into eight standardised business lines and the total capital requirement for operational risk is calculated as the sum of the capital requirements for each of the business lines. The risk for each business line is the beta coefficient multiplied by the average of the gross income from the preceding three financial years, where the beta coefficients differ between business lines and are in the range of 12% to 18%. Consequently, the operational risk capital charge is updated on an annual basis. The